It stays on this server, sealed in a cookie; your browser never sees it.
npm run admin -w @kestrel/api -- create-key